In order to properly mitigate a risk, it's important to first get a concrete or quantified sense of the risk's likelihood and potential loss or damage. Ideally, one can answer the following questions:

• What is the frequency of occurence of negative outcomes?
• What is the severity of these negative outcomes?
• Does frequency and or severity vary by the population of interest?
• How much historical data is available for calculating frequencies and severities?
• Is the available data reliable?
• Is the data sufficiently plentiful to allow statistical modeling?
• Is the data scarce enough to require expert judgment modeling?

Since by definition risk is associated with uncertainty, we're generally unable to perfectly quantify risks. Nevertheless, in the best case scenarios we are able to understand the behavior and manifestation patterns of risks and can take action appropriately, with a reasonable degree of certainty that our efforts will be effective.

Whenever rigorous statistical models are not attainable, we revert to anecdotal evidence and so-called expert judgment models, which are often as much art as science; we turn to people with relevant experience and ask for their best guesses; we seek qualitative descriptors of the risk that allow us to capture 'gut feelings.'

An important question is whether we're good at quantifying risk when we don't have the benefit of quantitative evidence and rigor?

Behavioral scientists would likely answer that question with a resounding 'no.' This answer is based on various empirical observations which indicate that we often do a very poor job of assessing uncertainty.

Some examples are that we play the lottery and gamble when an objective individual would recognize the odds are against him. Of course, an answer to such criticism is that there is more to such activities than objective odds of winning. There is also the thrill of playing the game and taking the risk. The argument goes that there is entertainment value from participation, in much the same way that we pay for theater and sporting event tickets. Nevertheless, there remains plentiful empirical evidence that we're unable to quantify risk well without the aid of rigorous models.

Why these failures?

The answer is likely a combination of the following:

• We don’t have enough information/data - this is often the factor that thwarts us despite best intentions
• Ignorance/naivte - we don't realize it's necessary
• Human (mis)perception - we think we have an answer when in reality we don't yet have a good one or human nature leads us astray
• Impatience & Distraction - we lack the commitment to seek a complete solution and instead get drawn to other tasks
• Camouflage - the true nature of the risk is purposely hidden from us by others or indeed by nature's cunning
• Environmental Dysfunction - the environment (people and cultures) get in the way of our achieving the task
• Significant uncertainty - Some problems are simply very difficult, and our best efforts fall short

Risk quantification usually improves over time. When a risk is important enough, efforts are made to collect data that allows better quantification. Innovative technology also makes more and better data accessible. This process may take years and even decades, but progress is made.